ggml/src/gguf.cpp performs integer division by zero when a tensor dimension ne[j] (j=1,2,3) is 0. The validation at line 622 checks ne[j] < 0 but allows 0 through. The overflow check at line 632 then divides by ne[1], ne[2], or ne[3], which is undefined behavior in C++.crash_ne1_zero.gguf - 75 bytes, ne[1]=0 triggers INT64_MAX/0crash_ne2_zero.gguf - 83 bytes, ne[2]=0 triggers INT64_MAX/0crash_ne3_zero.gguf - 91 bytes, ne[3]=0 triggers INT64_MAX/01git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
2cmake -B build && cmake --build build --target llama-gguf
3./build/bin/llama-gguf crash_ne1_zero.gguf r
4# x86-64: SIGFPE (Arithmetic exception)
5# ARM64: UB returns 0, then assertion failure1// Line 622: allows ne[j] == 0
2if (info.t.ne[j] < 0) { ok = false; break; }
3
4// Line 632: divides by ne[1], ne[2], ne[3] — UB when 0
5if (ok && ((INT64_MAX/info.t.ne[1] <= info.t.ne[0]) || ...))ne[j] <= 0 (reject zero dimensions).